Documentation · Trust Center

Security & Trust Center

How we organise information security, access control and data protection, and which evidence you get for your review.

Experience the platform live →Book a meeting (opens in a new tab)
BaFin
Xaver Asset Management GmbH, investment firm supervised by BaFin (WpIG), since 2025
ISO 27001
Xaver Group certified, since 2024
GDPR
roles set out in the contract
Trust Center
evidence, controls, subprocessors live
Trust Center · run on Vanta

Evidence live, not as a PDF.

Our Trust Center shows the state of our information security continuously. There you will find:

  • The Xaver Group's ISO 27001 certificate and the compliance status
  • Policies on security, HR, vendors, data protection and business continuity
  • Controls under continuous monitoring, grouped by area
  • Subprocessors with purpose and region
  • Documents in detail via an access request, directly in the Trust Center
Open the Trust Center
ISO 27001

Xaver Group certified · since 2024

You can find the certificate and audit evidence in the Trust Center, as well as hosting and subprocessors, dated.

Architecture

Architecture: where data sits and where it flows

  • Partner systems to Xaver platform: Master data. Xaver platform to Partner systems: Documents, Audit trail.
  • Xaver platform to Custody and investment layer: Suitability, Account opening. Custody and investment layer to Xaver platform: Documents.
  • Xaver platform to AI layer: Conversation. AI layer to Xaver platform: Inputs, handover. Xaver platform ↔ AI layer: Our AI conversation layer (AIC) leads the conversation and makes sure the language model never makes a recommendation itself: product and portfolio recommendations are calculated by fixed rules from the MiFID II suitability assessment, so every recommendation is traceable and auditable.
  • All connections: encrypted in transit and at rest.
Blue connection
All data flows: encrypted in transit and at rest.
Teal connection
AI layer: the AI adviser guides and explains, and recommendations are calculated by fixed rules. The voice assistant loads only after consent.
Zones
Hosting and subprocessors with purpose and region: trust.xaver.com, as of 16 October 2026. The Trust Center is authoritative.

Xaver Asset Management GmbH is a regulated investment firm (WpIG), since 2025. Here you can see how we organise information security, access control and data protection, and which evidence you get from us for your review.

You can find hosting and subprocessors in the Trust Center. We provide any further details you need for your review on request.

Last updated: 26 October 2026

Posture

Six areas, stated openly

Regulatory framework

Xaver Asset Management GmbH has been an investment firm supervised by BaFin (WpIG) since 2025. The regulated activities are supervised accordingly; the organisational, control and documentation duties that come with that are part of day-to-day operations, not a project alongside them.

  • Which regulatory obligation sits with whom depends on who advises, who intermediates and who is the product provider. We settle this with you in the contract.
  • Xaver does not take over a partner's regulatory duties wholesale. Each duty is allocated individually.

Information security management

Xaver Group is certified to ISO 27001. The certificate and audit evidence are available in the Trust Center and are provided during a review.

  • Security policies with named owners; the rules apply to all staff, not only to engineering.
  • Risks are recorded, assessed and matched with measures; the assessment is reviewed regularly.
  • Suppliers used are selected, contractually bound and reviewed.

Encryption

Data is encrypted in transit and stored encrypted at rest. We disclose procedures, key management and configuration to you in the review.

Access control

Access follows the principle of least privilege: every person and every technical credential receives exactly the rights the task requires, and no more.

  • Rights attach to roles rather than to case-by-case decisions; changes are traceable.
  • No shared credentials; administrative access is specially protected and separately logged.
  • Test and production environments are separated; in demonstration and training environments we work with test data, not with real customer data.
  • Data belonging to different partners is separated; one tenant's credentials do not reach into another.

Data protection

We process personal data in line with the General Data Protection Regulation and limit processing to what the respective purpose requires. Who is controller and who is processor depends on the model of cooperation. We settle this together at the start and record it in the contract.

  • A record of processing activities as well as the technical and organisational measures are part of what you receive in the review.

Hosting and subprocessors

The subprocessors we use are listed in the Trust Center with purpose and region; the diagram above names the hosting partners. The current state in the Trust Center is always the authoritative one. You can request further details for your review.

Documents for your review

For your security, outsourcing or procurement review we provide the following on request:

  • Completion of your security questionnaire in the format you use.
  • A record of processing activities as well as technical and organisational measures.
  • Details on hosting and subprocessors, complete and dated.
  • Information on our licence status and the allocation of regulatory roles in your project.
Open the Trust CenterSecurity contact

Please report security-relevant observations, vulnerabilities and suspected incidents to security@xaver.com. We acknowledge receipt and come back to you with an assessment.

Keep reading
A slowly turning, desaturated globe with relief coastlines, a few marked nodes and fine connecting lines.

Walk through your use case with us.

  • We show you the modules that matter for your case
  • With Max Bachem, founder & CEO
  • No obligation, no preparation needed
Book a meeting (opens in a new tab)Experience the platform live →
Would you rather ask something first?